How Theme Toolkit Ltd, trading as LoyalPack, handles personal information, for businesses using the service, for their customers, and for anyone visiting this website.
1. About this policy
This policy covers the LoyalPack website and web app, the LoyalPack App businesses use at the counter, the loyalty passes we issue to Apple Wallet and Google Wallet, and the email we send about the service. It explains what personal information is involved, why, who else sees it, how long it lasts and what you can ask us to do about it.
LoyalPack is a business-to-business service. Most people reading this will be one of three kinds of reader: a business using LoyalPack, someone holding a loyalty card issued by such a business, or a visitor to this website. Each has its own section below.
2. Who we are
LoyalPack is operated by Theme Toolkit Ltd, a company registered in England and Wales under company number 12462741, with its registered office at 4B Church Street, Diss, Norfolk, United Kingdom, IP22 4DD. Our UK VAT registration number is 446346281.
You can reach us about anything in this policy at support@loyalpack.co.uk, or by post at the registered office above. We do not have a separate data protection officer; messages to that address reach the people who can answer them.
3. Controller or processor: which we are, and when
UK data protection law distinguishes the organisation that decides why and how personal data is used (the controller) from one that handles it on that organisation's instructions (the processor). LoyalPack is both, in different parts of the same product, and the difference decides who you should ask about what.
The business is the controller of its loyalty programme data
When a business runs a loyalty programme on LoyalPack, that business decides to collect its customers' details, decides what the programme rewards and decides how long to keep running it. It is the controller of those records. Theme Toolkit Ltd processes them on its behalf, under the data processing commitments in section 7 of our Terms of Service. If you hold a loyalty card and want your details changed or removed, the business that issued the card is the right first contact, and we will help them act on it.
We are the controller of account, billing and support data
We decide how we run accounts, authenticate the people who sign in, bill for paid plans, answer support messages and keep the service secure. Theme Toolkit Ltd is the controller for that information, and the rest of this policy explains it.
4. Website visitors
You can read the public pages of this site, including this one, the Terms of Service and the support pages, without an account and without telling us who you are.
Like any website, ours is delivered through a hosting platform that automatically handles technical request data such as your IP address, the page you asked for, the time, and your browser's user agent string, in order to serve the page and keep the service secure and available. We also count requests per IP address in memory for short periods to rate-limit forms and other endpoints against abuse. We do not use this to build a profile of you.
Two public pages take information you type. The support contact form takes your name, your email address, a subject and your message, so we can reply. The card designer keeps the design you are working on so you can come back to it, stored against a random identifier in a cookie rather than against you.
5. Businesses and account users
When you sign up for LoyalPack and when you use your account, we hold:
- identity and contact details: your email address, your display name if you give one, your business name, and the trading details and locations you choose to enter;
- sign-in information: a password stored only as a salted hash if you use one, the sign-in methods you have connected, verification and password reset records, and the sessions and devices currently signed in;
- security records: sign-in, sign-out, verification and password events, each with a timestamp, and for some of them the IP address and browser user agent they came from, which is how an account owner can tell whether a sign-in was theirs;
- the account's team: the people invited to it, the role each has, and the record of invitations sent and accepted;
- what you have built: your programmes, card designs, uploaded logos and artwork, trading locations and opening times, and your plan;
- billing information: your plan, subscription status, invoices and payment events. Card numbers are handled by Stripe and never reach our systems;
- activity in the product: the stamps, rewards spent and enrolments recorded against your programme, with which account user issued each one, which is what the reports are built from.
If a member of our team needs to see your account to answer a support request, that access is recorded, and the record includes who did it, when and from which IP address.
6. Signing in with Google or Apple
You can sign in to LoyalPack with a password, with a single-use link sent to your inbox, or with your Google or Apple account. If you use Google or Apple, we receive from them a stable identifier for you, the email address on the account, and whether they have verified that address. We store that, and the fact that a provider is connected, so the next sign-in recognises you. We do not receive your password to those accounts, and we do not get access to your other data with them.
Apple offers a private relay address in place of your real one. If you use it, that relay address is what we hold and what we will email, and we record that it is a relay so nobody in support mistakes it for a typo.
You can disconnect a provider from your account at any time in your account settings, as long as you keep at least one way to sign in.
7. Loyalty card customers
If you have joined a loyalty programme run on LoyalPack, the business that runs it is the controller of your details and decides what they are used for. We hold them on that business's behalf, and what we hold is deliberately small:
- your first name and your email address, as you gave them on the enrolment form, where the business asks for them;
- your date of birth, where the business asks for it, which it uses only to give you a free stamp on your birthday;
- your phone number, where the business asks for it, which it keeps as a contact detail beside your name and email address;
- whether you agreed to hear from that business about its offers;
- the date you joined;
- your card: a random card code, how many stamps are on it, how many rewards are waiting, and its history of enrolments, stamps and rewards spent with timestamps, and the trading location where each happened where the business records one.
Each business decides which of those it asks for, and the sign-up page you filled in is the whole of it: a business can ask for all of those, some of them, or nothing at all beyond the card itself. We never ask you for a postal address or any payment details, and LoyalPack cards hold no money and are not payment cards. Nothing about what you bought is sent to us: a stamp records that a stamp was given, not what it was for.
Your card has a web page at a long, unguessable address. Anyone with that address can see the card, so treat the link as you would the card itself. To ask for a copy of your details, a correction, or deletion, contact the business that issued the card. If you cannot reach them, write to us at support@loyalpack.co.uk and we will do what we can to help, which normally means passing your request on to them.
8. Apple Wallet and Google Wallet
A LoyalPack card is added to your phone's wallet as a pass. Creating and updating that pass involves the wallet platform you chose.
For Apple Wallet, the pass file is generated by us and downloaded to your device. Your device may then register with our servers to receive updates, which means we hold a device identifier and a push token issued by Apple for that pass, so the stamps on it can change when you are stamped at the counter. Apple's push service carries the notification; it tells the device to ask us for a new pass and carries no card content itself. If Apple tells us the registration is dead, we delete it.
For Google Wallet, the card is created through Google's Wallet API, which means the card's display details (the programme name, your first name, the card code and the stamp count) are sent to Google and held in your Google account. Google's own privacy policy governs what they do with it.
Adding, keeping or removing a pass is your choice and is made on your device. Removing a pass from your wallet does not by itself remove your record from the business's programme; ask the business for that.
9. Support contacts
If you write to support, or use the contact form on the support pages, we hold your name, your email address and what you wrote, together with the page you sent it from, for as long as we need it to answer you and to keep a record of what was asked. Please do not put passwords or other secrets in a support message.
10. The companies that process data for us
We keep the list short on purpose, and we do not add to it lightly. These are the providers involved in running LoyalPack:
- Cloudflare hosts the service. The application, its database and the images uploaded to it all run on Cloudflare's platform, which also delivers the site and protects it from attack.
- Stripe processes payments and subscriptions for paid plans. Your card details go to Stripe, not to us; we keep the subscription status, the invoice record and the identifiers Stripe gives us.
- Mailgun delivers the email we send: sign-in links, verification and password reset messages, invitations and service notices. It handles the recipient address and the message.
- Apple and Google provide the wallet platforms, the push notification service that updates Apple passes, and the optional sign-in methods, as described in sections 6 and 8.
- Nominatim is the OpenStreetMap Foundation's geocoder, which turns an address you type into map coordinates when you set up a trading location. Our servers send the text of the search, not your identity, and we keep only the result you pick.
- Google Fonts serves the typefaces the pages are set in, which means your browser requests those files from Google and Google sees the request, including your IP address.
- Font Awesome serves the icon set used inside parts of the signed-in app, which involves the same kind of request from your browser.
- Iconify provides icon artwork for card designs. Our servers fetch it while you are designing a card; your browser never contacts it and no personal data is sent.
Each of these acts on our instructions or as an independent controller of the request their own service receives, and each is bound by its own terms and security obligations. We will update this list before we add a new provider that handles personal data.
12. Reporting and analytics
The charts and reports in the product are calculated by us from the programme's own records, in our own database. There is no third-party analytics product involved and no tracking pixel. We may look at aggregated, anonymised figures across the service, for example how many cards are issued in total, to understand how LoyalPack is used and to plan what to build; those figures do not identify any person or any business.
13. Our legal bases
Where Theme Toolkit Ltd is the controller, we rely on:
- performance of a contract, for running your account, providing the service and billing for it;
- legitimate interests, for keeping the service secure, preventing fraud and abuse, answering support requests, and improving the product. We have considered these against your interests and use the least information that will do;
- legal obligation, for tax and accounting records and for responding to lawful requests;
- consent, where we ask for it, such as sending you an optional message you have opted in to. You can withdraw consent at any time.
Where a business is the controller of its own loyalty programme, choosing its legal basis is that business's responsibility, not ours.
15. International transfers
Some of the providers in section 10 are based outside the United Kingdom, principally in the United States, and their infrastructure is global. Where personal information is transferred outside the UK, we rely on the safeguards UK law recognises, which in practice means the UK extension to the European Commission's standard contractual clauses, an adequacy decision, or the provider's certification under an approved framework, depending on the provider. You can ask us which applies to a particular provider at support@loyalpack.co.uk.
16. How long we keep things
We keep personal information for as long as we need it, and no longer:
- account, programme and customer records last while the account is open. When an account closes we remove or anonymise them within a reasonable period, normally within 90 days, unless we are required to keep something;
- security and sign-in event records, which is how a suspicious sign-in can be investigated, are kept for up to 24 months;
- billing and invoice records are kept for six years after the end of the financial year they relate to, because tax law requires it;
- support messages are kept for up to 24 months after the conversation ends;
- short-lived items, such as sign-in links, verification codes, password reset grants and unfinished card designs, expire on their own, usually within hours or days;
- where a business asks us to delete records from its programme, we act on that as its processor.
17. Security
We take measures appropriate to the risk. Traffic is encrypted in transit. Passwords are stored only as salted hashes and never in a form we could read. Session and reset tokens are stored hashed, are signed, and expire. Access to an account is limited to the people it has invited and to the roles they hold, and access by our own team for support is deliberate, limited and recorded. Payment card details never reach our systems.
No service can promise perfect security. If a personal data breach affects you and the law requires it, we will tell you and the regulator within the time the law allows, and we will tell an affected business without undue delay about data we hold for it.
18. Your rights
Under UK data protection law you can ask for a copy of the personal information held about you, ask for it to be corrected, ask for it to be deleted, ask us to restrict or object to how it is used, ask for it in a portable form, and withdraw consent where we relied on it. Exercising a right does not cost anything, and we answer within one month, or tell you if we need longer.
Ask us at support@loyalpack.co.uk. We may need to check who you are before we act. If your request is about a loyalty card, ask the business that issued the card first: they decide, and we act for them.
If you are not happy with how we have handled your information, please tell us so we can put it right. You can also complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk.
19. Children
LoyalPack accounts are for businesses, and anyone using an account must be at least 18. Loyalty programmes are run by the businesses themselves, and a business that expects children to join its programme is responsible for meeting the extra requirements that apply to it. We do not knowingly collect information from children through our own site, and if you believe we hold any, write to support@loyalpack.co.uk and we will remove it.
20. Changes to this policy
We update this policy when the service changes or when the law does. The date at the top of the page is when the current version took effect. If a change materially affects how we use personal information, we will give reasonable notice by email or in the product before it takes effect.
21. Contact
Write to support@loyalpack.co.uk, or to Theme Toolkit Ltd, 4B Church Street, Diss, Norfolk, United Kingdom, IP22 4DD. Our Terms of Service set out the agreement this policy sits alongside.